mirror/librenms-librenms
1
0
Fork 0
mirror of https://github.com/librenms/librenms.git synced 2024-10-07 16:52:45 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fix some xss injection for sysLocation and some other fields (#15183)

Browse Source 
Reported by [Zluudg](https://huntr.dev/users/zluudg/)
This commit is contained in:
Tony Murray
2023-08-02 09:51:31 -05:00
committed by GitHub
parent d810c7a648
commit 3252ea37af
6 changed files with 22 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
app/Http/Controllers/Table/DeviceController.php
View File

@@ -153,10 +153,10 @@ class DeviceController extends TableController
'icon' => '<img src="' . asset($device->icon) . '" title="' . pathinfo($device->icon, PATHINFO_FILENAME) . '">',
'hostname' => $this->getHostname($device),
'metrics' => $this->getMetrics($device),
'hardware' => Rewrite::ciscoHardware($device),
'os' => $this->getOsText($device),
'hardware' => htmlspecialchars(Rewrite::ciscoHardware($device)),
'os' => htmlspecialchars($this->getOsText($device)),
'uptime' => (! $device->status && ! $device->last_polled) ? __('Never polled') : Time::formatInterval($device->status ? $device->uptime : $device->last_polled->diffInSeconds(), true),
'location' => $this->getLocation($device),
'location' => htmlspecialchars($this->getLocation($device)),
'actions' => view('device.actions', ['actions' => $this->getActions($device)])->__toString(),
'device_id' => $device->device_id,
];

2
app/Http/Controllers/Table/LocationController.php
View File

@@ -79,7 +79,7 @@ class LocationController extends TableController
{
return [
'id' => $location->id,
'location' => $location->location,
'location' => htmlspecialchars($location->location),
'lat' => $location->lat,
'lng' => $location->lng,
'down' => $location->devices()->isDown()->count(),